{"id":"CVE-2003-0096","aliases":["EUVD-2003-0092","GHSA-q3h7-99f2-hhfv"],"status":"published","title":"Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow...","description":"Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3) a long DIRECTORY parameter to the BFILENAME function.","severity":{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.15931,"percentile":0.96919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2003-02-21T05:00:00Z","modified":"2026-06-16T22:01:30Z","products":[{"vendor":"oracle","product":"database_server"},{"vendor":"oracle","product":"oracle8i"},{"vendor":"oracle","product":"oracle9i"}],"references":[{"url":"http://otn.oracle.com/deploy/security/pdf/2003alert48.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.nextgenss.com/advisories/ora-tmstmpbo.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0083.html","tags":["mailing-list","x_refsource_VULNWATCH","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0075.html","tags":["mailing-list","x_refsource_VULNWATCH","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/743954","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/6850","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104549743326864\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.iss.net/security_center/static/11325.php","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/840666","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"http://www.cert.org/advisories/CA-2003-05.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","US Government Resource"]},{"url":"http://otn.oracle.com/deploy/security/pdf/2003alert50.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.ciac.org/ciac/bulletins/n-046.shtml","tags":["third-party-advisory","government-resource","x_refsource_CIAC","x_transferred"]},{"url":"http://www.iss.net/security_center/static/11327.php","tags":["vdb-entry","x_refsource_XF","x_transferred","Vendor Advisory"]},{"url":"http://otn.oracle.com/deploy/security/pdf/2003alert49.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.nextgenss.com/advisories/ora-bfilebo.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/bid/6847","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.iss.net/security_center/static/11326.php","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.nextgenss.com/advisories/ora-tzofstbo.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0073.html","tags":["mailing-list","x_refsource_VULNWATCH","x_transferred"]},{"url":"http://www.securityfocus.com/bid/6848","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104550346303295\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/663786","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104549782327321\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-0096"},{"url":"https://github.com/advisories/GHSA-q3h7-99f2-hhfv"}],"sources":{"cve":[{"id":"CVE-2003-0096","description":"Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3) a long DIRECTORY parameter to the BFILENAME function.","status":"published","published":"2003-02-21T05:00:00Z","modified":"2024-08-08T01:43:35.487Z","updated_at":"2026-11-02T14:20:16.411288Z"}],"euvd":[{"id":"EUVD-2003-0092","description":"Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3) a long DIRECTORY parameter to the BFILENAME function.","status":"published","published":"2003-02-21T05:00:00Z","modified":"2024-08-08T01:43:35Z","updated_at":"2026-11-03T01:15:08.689521Z"}],"ghsa":[{"id":"GHSA-q3h7-99f2-hhfv","title":"Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow...","description":"Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3) a long DIRECTORY parameter to the BFILENAME function.","status":"published","published":"2022-04-29T01:25:50Z","modified":"2023-01-30T05:00:46Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:46:16.34482Z"}],"nvd":[{"id":"CVE-2003-0096","description":"Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3) a long DIRECTORY parameter to the BFILENAME function.","status":"published","published":"2003-03-03T05:00:00Z","modified":"2026-06-16T22:01:30.923Z","cvss":[{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:00:46.710758Z"}]}}